diff --git a/.github/workflows/move-major-minor-tags.yml b/.github/workflows/move-major-minor-tags.yml
index 63e4443..cada3ad 100644
--- a/.github/workflows/move-major-minor-tags.yml
+++ b/.github/workflows/move-major-minor-tags.yml
@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/reusable-pre_commit.yml b/.github/workflows/reusable-pre_commit.yml
index 1452b8c..ce61261 100644
--- a/.github/workflows/reusable-pre_commit.yml
+++ b/.github/workflows/reusable-pre_commit.yml
@@ -53,7 +53,7 @@ jobs:
           depth=$(expr ${{ github.event.pull_request.commits }} + 1)
           echo "base-depth=$depth"
           echo "base-depth=$depth" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: ${{ inputs.lfs }}
           # for non PR events, check out to depth 1 (the default)
@@ -69,7 +69,7 @@ jobs:
         run: |
           git config --local --unset-all http.https://github.com/.extraheader || [ $? -eq 5 ]
           git config --local --unset-all include.path || [ $? -eq 5 ]
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ inputs.python-version }}
       - name: Install uv
@@ -77,7 +77,7 @@ jobs:
       - name: Install pre-commit with uv
         run: uv tool install pre-commit
       - name: Cache for pre-commit hooks
-        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/reusable-python-build_poetry_package.yml b/.github/workflows/reusable-python-build_poetry_package.yml
index 85b439d..f1ec3fe 100644
--- a/.github/workflows/reusable-python-build_poetry_package.yml
+++ b/.github/workflows/reusable-python-build_poetry_package.yml
@@ -66,7 +66,7 @@ jobs:
             version: ${{ steps.get-version.outputs.version }}
         steps:
             -   name: Checkout
-                uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
                     lfs: ${{ inputs.lfs }}
                     fetch-depth: 0
@@ -94,7 +94,7 @@ jobs:
                     JF_ACCESS_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
 
             -   name: Set up Python version
-                uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+                uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
                 with:
                     python-version: ${{ inputs.python-version }}
             -   name: Install poetry
diff --git a/.github/workflows/reusable-python-build_setuptools_package.yml b/.github/workflows/reusable-python-build_setuptools_package.yml
index b140c29..0311e2d 100644
--- a/.github/workflows/reusable-python-build_setuptools_package.yml
+++ b/.github/workflows/reusable-python-build_setuptools_package.yml
@@ -61,7 +61,7 @@ jobs:
             version: ${{ steps.get-version.outputs.version }}
         steps:
             -   name: Checkout
-                uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
                     lfs: ${{ inputs.lfs }}
                     fetch-depth: 0
@@ -88,7 +88,7 @@ jobs:
                     JF_URL: https://${{ secrets.JFROG_ARTIFACTORY_URL }}
                     JF_ACCESS_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
             -   name: Set up Python version
-                uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+                uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
                 with:
                     python-version: ${{ inputs.python-version }}
             -   name: Verify package installation
diff --git a/.github/workflows/reusable-python-publish_rattler_package.yml b/.github/workflows/reusable-python-publish_rattler_package.yml
index 9c4568c..c1d12f8 100644
--- a/.github/workflows/reusable-python-publish_rattler_package.yml
+++ b/.github/workflows/reusable-python-publish_rattler_package.yml
@@ -88,13 +88,13 @@ jobs:
             RECIPE_PATH: ${{ inputs.recipe-path || format('{0}/{1}', inputs.source-path || '.', 'recipe.yaml') }}
         steps:
             -   name: Checkout
-                uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+                uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
                 with:
                     lfs: ${{ inputs.lfs }}
                     fetch-depth: 0
                     persist-credentials: false
             -   name: Set up Python version
-                uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+                uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
                 with:
                     python-version: ${{ inputs.python-version }}
             -   name: Generate package version
diff --git a/.github/workflows/reusable-python-pytest.yml b/.github/workflows/reusable-python-pytest.yml
index 37bf4a6..63aacc0 100644
--- a/.github/workflows/reusable-python-pytest.yml
+++ b/.github/workflows/reusable-python-pytest.yml
@@ -1,4 +1,4 @@
-name: Pytest on any OS
+name: Pytest on any OS
 
 on:
   workflow_call:
@@ -121,14 +121,14 @@ jobs:
         shell: 'bash -l {0}'
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: ${{ inputs.lfs }}
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Python version
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: ${{ inputs.package-manager == 'poetry' || inputs.package-manager == 'hatch' }}
         with:
           python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/reusable-python-static_analysis.yml b/.github/workflows/reusable-python-static_analysis.yml
index ed0d3a2..575a231 100644
--- a/.github/workflows/reusable-python-static_analysis.yml
+++ b/.github/workflows/reusable-python-static_analysis.yml
@@ -1,4 +1,4 @@
-name: Static analysis
+name: Static analysis
 
 on:
   workflow_call:
@@ -122,7 +122,7 @@ jobs:
         shell: 'bash -l {0}'
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: ${{ inputs.lfs }}
           fetch-depth: 0
@@ -173,7 +173,7 @@ jobs:
           git config --local --unset-all include.path || [ $? -eq 5 ]
 
       - name: Set up Python version
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: ${{ inputs.package-manager == 'poetry' || inputs.package-manager == 'hatch' }}
         with:
           python-version: ${{inputs.python-version}}
diff --git a/.github/workflows/reusable-version-check.yml b/.github/workflows/reusable-version-check.yml
index 45d6ef8..775113b 100644
--- a/.github/workflows/reusable-version-check.yml
+++ b/.github/workflows/reusable-version-check.yml
@@ -36,7 +36,7 @@ jobs:
           requires-python = ">=3.12"
           EOF
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: Setup uv
diff --git a/.github/workflows/reusable-zizmor-advanced-security.yml b/.github/workflows/reusable-zizmor-advanced-security.yml
index e720fa8..565bd31 100644
--- a/.github/workflows/reusable-zizmor-advanced-security.yml
+++ b/.github/workflows/reusable-zizmor-advanced-security.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-zizmor-annotate.yml b/.github/workflows/reusable-zizmor-annotate.yml
index 5e33e43..76145e8 100644
--- a/.github/workflows/reusable-zizmor-annotate.yml
+++ b/.github/workflows/reusable-zizmor-annotate.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-zizmor-security.yml b/.github/workflows/reusable-zizmor-security.yml
index 797fe7f..de2b2c8 100644
--- a/.github/workflows/reusable-zizmor-security.yml
+++ b/.github/workflows/reusable-zizmor-security.yml
@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false